Official Blog of Ahsay Backup

October 2014

To address the recently-discovered SSLv3 security vulnerability (the “POODLE” vulnerability), we will not support SSLv3 connection between your OBS, RPS, RDR, UBS to the Ahsay License Server starting 12 January 2015. We will support connection over TLS instead.

Impact on our Partners

Our software release (V.6.21.2.0) will support connections between all our components (OBS-OBM, OBS-RPS, OBS-ALS, etc.) over TLS to stop this security leakage. It is important for you to upgrade your Ahsay™ Backup Software to this version ASAP to avoid exposing your customers’ data to such risk. We will be running in parallel SSLv3 & TLS until early January 2015 so you can plan ahead on your upgrade when we close out on this breach in a timely manner.

Since the connection between OBS and ACB/OBM is also using SSLv3 for Versions earlier than 6.21.2.0, you should upgrade your client-side software (OBM/ACB) to Version 6.21.2.0 as well to stop this vulnerability on your customer side and protect their data.

After early January 2015

Partners who run on a model that needs regular connection to the Ahsay™ License Server must upgrade their software to Version 6.21.2.0 or later. Without connection to the Ahsay™ License Server, your software will not be functional. Such partners include:

On Relaxing License

While perpetual license keys are not affected, relax key request cannot be entertained unless OBS/RPS is Version 6.21.2.0 or above. We understand this will impose additional works for our partners but we cannot keep our License Server vulnerable to attacks which may cause more problems. Partners are therefore recommended to make a plan to upgrade their software to Version 6.21.2.0 as soon as possible.

In this release, the Ahsay’s dummy cert of the new AhsayOBS now comes with SHA-2 cypher for SSL certificates and the embedded dummy certificate is SHA-256 signed by the 2014 CA certificate. Besides, AhsayOBM and AhsayACB now support multiple concurrent VSS snapshot instances for file and Hyper-V backups. They also support Thawte DV SSL CA – G2 SSL certificate. Moreover, AhsayOBM VMware backupset’s Product Version list now includes VMware Fusion 7.